Incident Response Engineer

Role overview Lead and improve security incident response across cloud, endpoint, identity, SaaS, and AI environments. You will investigate escalations, command critical incidents, and build automated and AI-assisted workflows that help responders triage threats quickly while preserving human judgment.

Responsibilities - Direct investigations and serve as Incident Commander for critical security incidents. - Deploy and refine AI agents that assist with initial triage, context gathering, and investigation. - Build Python scripts, automation pipelines, and agentic workflows to enrich alerts and reduce manual work. - Improve detections, threat signatures, and safeguards against conventional and AI-enabled attacks. - Coordinate response with detection, product security, legal, HR, cloud, and data teams. - Participate in a periodic on-call rotation, which may include nonstandard hours.

Requirements - Strong incident response and security investigation experience, including leading incidents; two or more years in incident response or security operations is preferred. - Advanced hands-on use of EDR, SIEM, SOAR, and DLP capabilities across endpoints, identity systems, SaaS, and cloud workloads. - Proficiency in Python for orchestration, alert enrichment, and response automation. - Strong understanding of cloud security on AWS, GCP, or Azure, and container isolation with Docker or Kubernetes. - Experience with AI and LLM security tools, telemetry, and threats; knowledge of protecting model pipelines and agent permissions. - Ability to analyze malware and turn root-cause findings into immediate fixes and longer-term security improvements.

Nice to have - Threat hunting or detection-as-code experience. - Experience with sensitive investigations involving legal or HR teams. - Familiarity with large-scale security telemetry, open-source security work, or certifications such as GCIH, GCFA, or GREM.